Privacy

Privacy Policy for TRLLN

Last updated: November 10, 2026

This policy explains what personal data TRLLN collects, why, how long we keep it, who we share it with and how you can exercise your rights. It covers our website at trlln.io, the TRLLN platform at app.trlln.io and our APIs. Our mobile apps have their own policies, linked at the end.

Who we are

The controller of the personal data described in this policy is TRLLN S.L., Plaça de Pau Vila, 1, Ciutat Vella, 08039 Barcelona, Spain.

Contact for anything related to your personal data: customer-support@trlln.io.

When you use the platform through your organisation’s account, your organisation decides who gets an account and what data is loaded into it. For that data we act on your organisation’s behalf under our agreement with it.

What we collect and why

Platform account

  • Data: name, e-mail address, the organisations and roles you have access to, and your last login. Passwords are handled by our identity provider (Auth0); we never see them.
  • Why: to give you secure access to the platform and manage your account.
  • Legal basis: our legitimate interest, and your organisation’s, in providing the service your organisation has contracted (Art. 6(1)(f) GDPR).

Alert e-mails

  • Data: your e-mail address and the content of the alert (device label, alert type, threshold, measured value, time and a link to the device).
  • Why: to send you the alerts you or your organisation subscribed you to.
  • Legal basis: legitimate interest in providing the contracted service (Art. 6(1)(f) GDPR).

Security, logs and error monitoring

  • Data: IP address, user id, browser and device information, and technical details when an error happens. When an error occurs in the platform, a short screen recording may be captured to help us fix it; all text and images in it are masked.
  • Why: to keep the platform secure and reliable, detect misuse and fix errors.
  • Legal basis: legitimate interest in the security and reliability of the service (Art. 6(1)(f) GDPR).

Product analytics (only if you allow it)

  • Data: how you use features and navigate the platform, linked to your account.
  • Why: to understand how the platform is used and improve it.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). It is off unless you choose “Allow” when we ask, and you can change your mind at any time in Settings → Privacy.

Website analytics (only if you accept)

  • Data: pages visited, a random client id, approximate location, device and browser information, collected by Google Analytics 4 with cookies.
  • Why: to measure traffic and improve the website.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). Google Analytics is only loaded if you accept it in the cookie banner; you can change your choice at any time via “Cookie settings” in the footer.

Demo requests and contact

  • Data: name, role, work e-mail, company, sector and number of assets you enter in the demo form, or what you send us by e-mail.
  • Why: to answer you and organise a demo.
  • Legal basis: steps you ask us to take before a possible contract and our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f) GDPR).

Job applications

  • Data: what you send us when you apply by e-mail (CV, contact details, cover letter).
  • Why: to assess your application.
  • Legal basis: steps you ask us to take before a possible employment contract (Art. 6(1)(b) GDPR).

Tracking data

Sensor readings, positions and scan events from TRLLN devices relate to your organisation’s assets, not to people. The one exception is the TRLLN Collect mobile app, which sends the phone’s location and a device identifier with each scan; see its own policy below.

Cookies and similar technologies

  • Essential (no consent needed): the cookies and browser storage that keep you signed in and remember your settings in the platform, and the cookie banner choice on the website.
  • Analytics (only with your consent): Google Analytics 4 on the website, Amplitude in the platform.

We do not use advertising cookies. The video on our website uses YouTube’s privacy-enhanced mode, which sets no tracking cookie until you press play.

How long we keep it

  • Platform account: while your account is active. When the account is deleted, your name and e-mail are removed; a record of the deletion is kept without your e-mail.
  • Security and application logs: application logs for a short period (about 30 days); security audit logs, which contain user ids but not e-mails, for up to about 13 months.
  • Error reports, product and website analytics: for the limited retention period set with each provider, after which they are deleted automatically; analytics data is deleted earlier if you ask us.
  • Demo requests and contact: as long as needed to follow up on your enquiry and any resulting business relationship.
  • Job applications: for the duration of the recruitment process, unless you agree that we keep your application for future openings.

Who we share it with

We use the following providers to run TRLLN. They process personal data only on our instructions and under data-processing agreements:

  • Google Cloud — hosting of the platform and its data (EU, Frankfurt).
  • Okta (Auth0) — sign-in and identity (EU).
  • Sentry — error monitoring (EU, Germany).
  • Amplitude — product analytics, only with your consent (EU).
  • Twilio SendGrid — delivery of alert e-mails (USA).
  • Google Maps Platform — maps and Wi-Fi / cell-tower assisted positioning in the platform (global).
  • Google Analytics — website analytics, only with your consent.
  • DigitalOcean — hosting of the website (EU, Frankfurt); Google Fonts and unpkg deliver fonts and scripts for the website, which means your browser’s IP address reaches them.
  • Cloudflare and Brevo — handling and delivery of demo-form submissions to our team.
  • Google Workspace — our e-mail, including the mailboxes that receive your messages.

Within the TRLLN group, personal data is shared with TRLLN GmbH (Pullach, Germany) only as needed to provide the service and support you. We do not sell personal data.

Transfers outside the EU

We keep the platform’s data in the EU. Some providers process data outside the European Economic Area, for example Twilio SendGrid for alert e-mails and Google for maps, positioning and website analytics. Those transfers are protected by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses.

How we protect it

  • Data is encrypted in transit and at rest.
  • Each organisation’s data is isolated from other organisations.
  • Access to personal data is limited to the TRLLN staff who need it to run and support the service.

Your rights

You can ask us to:

  • give you a copy of your personal data (access and portability);
  • correct it (rectification);
  • delete it (erasure);
  • limit how we use it (restriction), or object to processing based on legitimate interest;
  • withdraw a consent you gave, at any time, without affecting what was done before.

To exercise any of these rights, e-mail customer-support@trlln.io from the address linked to your account. We answer within one month. If you use the platform through your organisation, we may involve your organisation’s administrator.

You also have the right to lodge a complaint with a data-protection authority, in particular the Spanish Agencia Española de Protección de Datos (aepd.es) or the authority of the EU country where you live or work.

Mobile applications

Our mobile apps have their own privacy policies:

Changes to this policy

We update this policy when what we do with personal data changes, and change the “Last updated” date at the top. For significant changes affecting platform users we will also let you know in the platform or by e-mail.

Contact us

Questions about this policy or your data: customer-support@trlln.io.